1

What is the best way to get calling x-refs for a specific function?

I am aware of the following method:

func = getFirstFunction()

while func is not None:
    func_name = func.getName()
    if func_name == <my_func>:
        entry_point = func.getEntryPoint()
        references = getReferencesTo(entry_point)

func = getFunctionAfter(func)

Is there a way to do that without iterating through all the functions?

1

getReferencesTo takes an address

toAddr() converts a string to Address you can combine both

like this

>>> getReferencesTo(toAddr("ZwCreateKey"))

array(ghidra.program.model.symbol.Reference, 
[
From: 14095680c To: 1401b33c0 Type: DATA Op: 0 IMPORTED, 
From: 140a22fbd To: 1401b33c0 Type: DATA Op: 0 DEFAULT, 
From: Entry Point To: 1401b33c0 Type: EXTERNAL Op: -1 DEFAULT, 
From: 140628dc5 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1407478dd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1406bdfcd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1408db10c To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1406f5dec To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1407c7190 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1407d01da To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1405a8745 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 

the function limits its display to max 4096 refs if there are more use the recommended ReferenceManager

>>> refs = currentProgram.referenceManager.getReferencesTo(toAddr("ZwCreateKey"))
>>> for i in refs:
...     print i
... 
From: 14095680c To: 1401b33c0 Type: DATA Op: 0 IMPORTED
From: 140a22fbd To: 1401b33c0 Type: DATA Op: 0 DEFAULT
From: Entry Point To: 1401b33c0 Type: EXTERNAL Op: -1 DEFAULT
From: 140628dc5 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT
From: 1407478dd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT
From: 1406bdfcd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT
From: 1408db10c To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT
1

I don't think there is a method that filters functions by name, but you can write the above a bit more concise with lambdas and a bit more functional approach.

fm = currentProgram.getFunctionManager()
funcs = fm.getFunctions(True)
filtered_funcs = filter(lambda f: f.getName() == '<your function name>', funcs)
x_refs = map(lambda f: getReferencesTo(f.getEntryPoint()), filtered_funcs)

You could even fold them more but (probably) hurting the readability.

0

This is possible via the Symbol Table:

sym = currentProgram.symbolTable.getSymbol(func_name)

func = currentProgram.functionManager.getFunction(sym.key)
# the following should be equivalent
func = currentProgram.functionManager.getFunctionAt(sym.address)

refs = getReferencesTo(func.entryPoint)

Symbols in this case are the Ghidra Function symbols, not the kind of symbols which might be contained in binary, but could be stripped. It works with names like FUN_100008628, entry, or any function you renamed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.